PSD2 SCA: every control, and what you already have

28 controls 147 frameworks share controls with it European Union verified against its source document

Every control below is one this framework asks for. The right hand column counts how many other frameworks in our corpus carry the same control, which is the difference between doing this work once and doing it again for the next standard.

There is no implementation kit for this framework yet. The control list and the overlap above are free and complete.

What you already have

Frameworks whose controls overlap this one, most first. If you run any of them, the count is roughly what you have already evidenced.

If you run	Shared controls
Annex 11 to EU GMP	4	measure it →
API 1164	4	measure it →
APPI	4	measure it →
APRA CPS 230 Operational Risk Management	4	measure it →
APRA CPS 234	4	measure it →
ASD Strategies to Mitigate Cyber Security Incidents	4	measure it →
ASIS SPC.1-2009	4	measure it →
Bahrain PDPL	4	measure it →
Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL)	4	measure it →
FFIEC Cybersecurity Assessment Tool (CAT)	4	measure it →
FFIEC IT Examination Handbook	4	measure it →
FTC GLBA Safeguards Rule (16 CFR Part 314)	4	measure it →

Every control

Code	Control	Also in
`PSDTWO-1`	Strong Customer Authentication (SCA) Core Requirements	127
`PSDTWO-2`	SCA Exemptions and Risk-Based Authentication	83
`PSDTWO-3`	Common and Secure Communication, API Access for AISPs and PISPs	80
`PSDTWO-4`	Fraud Reporting and Incident Management	56
`PSDTWO-5`	Customer Authentication Methods, Biometric Controls, Device Binding	0
`PSDTWO-6`	Governance, Risk Management, Compliance Monitoring	0
`RTS-A1`	General Authentication Requirements	1
`RTS-A10`	Exemption: Information on Payment Accounts	0
`RTS-A11`	Exemption: Contactless Low Value	0
`RTS-A12`	Exemption: Unattended Terminals for Transport or Parking Fares	0
`RTS-A13`	Exemption: Trusted Beneficiaries	0
`RTS-A14`	Exemption: Recurring Transactions	0
`RTS-A15`	Exemption: Credit Transfers Between Accounts of the Same Person	0
`RTS-A16`	Exemption: Low Value Remote Transactions	0
`RTS-A18`	Transaction Risk Analysis Exemption	1
`RTS-A19`	Fraud Rate Calculation and Reporting	0
`RTS-A2`	Authentication Code Properties	1
`RTS-A20`	Cessation of Exemption Use	0
`RTS-A22`	Confidentiality and Integrity of Credentials	0
`RTS-A24`	Issuing of Credentials	0
`RTS-A26`	Renewal of Credentials	0
`RTS-A30`	Common and Secure Communication Interface	0
`RTS-A36`	Data Exchange Requirements for TPPs	0
`RTS-A4`	Dynamic Linking	1
`RTS-A6`	Requirements of Knowledge Elements	0
`RTS-A7`	Requirements of Possession Elements	0
`RTS-A8`	Requirements of Inherence Elements	0
`RTS-A9`	Independence of Elements	0

Tell me when PSD2 SCA files something new

One email when a public company newly discloses something this framework governs, naming the company and what our corpus says it puts in scope. Nothing else, and one click to stop.

What this page is

A control-level reference for PSD2 SCA, drawn from our framework corpus. Control codes and titles are references to the standard, not reproductions of it. The overlap counts and the auditor artefacts are our own work and are the part you will not find elsewhere.

Measure this against what you already run · All frameworks · Today's edition